
The. % 



% Office * 



,4* 



PRIORITY 
DOCUMENT 



18 

T/GB 2003 / 0 0 3 



, J$l 2005 



REC'D 1 5 AUG 2003 



WIPO 




rirvESTOR m people 



PCT 

The Patent Office 
Concept House 
Cardiff Road 
Newport 
South Wales 
NP10 8QQ 



I, the undersigned, being an officer duly authorised in accordance with Section 74(1) and (4) 
of the Deregulation & Contracting Out Act 1994, to sign and issue certificates on behalf of the 
Comptroller-General, hereby certify that annexed hereto is a true copy of the documents as 
originally filed in connection with the patent application identified therein. 



In accordance with the Patents (Companies Re-registration) Rules 1982, if a company named 
in this certificate and any accompanying documents has re-registered under the Companies Act 
1980 with the same name as that with which it was registered immediately before re- 
registration save for the substitution as, or inclusion as, the last part of the name of the words 
"public limited company" or their equivalents in Welsh, references to the name of the company 
in this certificate and any accompanying documents shall be treated as references to the name 
with which it is so re-registered. 



In accordance with the rules, the words "public limited company" may be replaced by p. I.e., 
pic, P.L.C. or PLC. 



Re-registration under the Companies Act does not constitute a new legal entity but merely 




BEST AVAILABLE COPY 




Patent 
Office 



t also get an 

explanatory leaflet from the Patent Office to help you Gil in 



U p ' 0 



-P01/770Q 0.00-0216742,7 



The Patent Office 

Cardiff Road 
Newport 
South Wales 
NP9 1RH 



1. Your reference 



P33609GB/JJH 



2. Patent application number 

— 0216742.7 -7 

each applicant (underline all surnames) 



Patents ADP number (if you know It) 

If the applicant is a corporate body, give the 
country/state of its incorporation 



18 JUL 2002 



Ricardo Consulting Engineers Limited 
Bridge Works, Shoreham-by-Sea, 
West Sussex, BN43 5FG 



United Kingdom 



4. Title of the invention 

Self-testing Watch Dog System 



5. Name of your agent (if you have one) 

"Address for service" in the United Kingdom 
to which all correspondence should be sent 
(including the postcode) 



Kilburn & Strode 
20 Red Lion Street 
London 
WG1R4PJ 



Patents ADP number (if you know it) 



125001V 



If you are declaring priority from one or more 
earlier patent applications, give the country 
and the date of filing of the or of each of these 
earlier applications and (if you know it) the or 
each application number 



Country Priority application number Date of filing 

(if you know it) (day / month /year) 



7. If this application is divided or otherwise 
derived from an earlier UK application, 
give the number and the filing date of 
the earlier application 



Number of earlier application 



Date of filing 
(day /month /year) 



Is a statement of inventorship and of right 
to grant of a patent required in support of 
this request? (Answer 'Yes* if: 

a) any applicant named in part 3 is not an inventor, or 

b) there is an inventor who is not named as an 
applicant, or 

c) any named applicant is a corporate body. 
See note (d)) 



YES 



Patents Form 1 /77 



i Form 1/77 



9mfi jBr the number of sheets for any of the 

^Blowing items you are filing with this form. 
Do not count copies of the same document 

Continuation sheets of this form 
Description 

Claim <y 
Abstract 

Drawings; 



3 J 
1 



10. If you are also filing any of the following, 
state how many against each item. 

Priority documents 

Translations of priority documents 

Statement of inventorship and right 
to grant of a patent (Patents Form 7/77) 

Request for preliminary examination 
and search (Patents Form 9/77) 



Request for substantive examination 

(Patents Form 10/77) 

Any other documents 

(please specify) 



11. 



I/We request the grant of a patent on the basis of this application. 



Signature 



12. Name and daytime telephone number of 
person to contact in the United Kingdom 



Hibbert, Juliet Jane Grace 
Tel: 020 7539 4200 



Warning 

After an application for a patent has been filed, the Comptroller of the Patent Office will consider whether publication 
or communication of the invention should be prohibited or restricted under Section 22 of the Patents Act 1977. You 
will be informed if it is necessary to prohibit or restrict your invention in this way. Furthermore, if you live in the 
United Kingdom, Section 23 of the Patents Act 1977 stops you from applying for a patent abroad without first getting 
written permission from the Patent Office unless an application has been filed at least 6 weeks beforehand in the 
United Kingdom for a patent for the same invention and either no direction prohibiting publication or 
communication has been given, or any such direction has been revoked. 

Notes 

a) If you need help to fill in this form or you have any questions, please contact the Patent Office on 0645 500505. 

b) Write your answers in capital letters using black ink or you may type them. 

c) If there is not enough space for all the relevant details on any part of this form, please continue on a separate 
sheet of paper and write "see continuation sheet" in the relevant part(s). Any continuation sheet should be 
attached to this form. 

d) If you ha ve answered Yes ' Patents Form 7/77 will need to be filed. 

e) Once you ha ve filled in the form you must remember to sign and date it. 

f) For details of the fee and ways to pay please contact the Patent Office. 



Patents Form 1/77 



1/2 
Fig. 1 




Receive command to 
Switch off 



Cease some operations 
of processor 

s . / 



Monitor for generation 
of fault signal 




Shut down processor 







Start up processor 








Generate 
alarm signal 



Continue 




Self Test System 

This invention relates to a self -test process and apparatus for use with control 
system, in particular but not exclusively for use in vehicles. 
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Electronic systems that use processors, such as microprocessors, are known 
that have programmable interrupt controllers that handle interrupts from 
internal or external sources. Such interrupts may represent faults (e.g. power- 
failing warnings, watch-dog timer signals, software or hardware malfunctions 
- 10 etc.) Such interrupt controllers are therefore central to monitoring the 
operation of processors of the electronic systems. An example of such a 
system is described in US Patent no. 5625836. 

In accordance with the invention there if provided a self-test method for an 
15 electronic system including a processor, the method comprising: 

stopping operation of the processor and monitoring for the generation of 
a fault signal from a fault-detecting device, 

on generation of a fault signal from the fault-detecting device on 
stopping of the operation of the processor, storing a record to this effect in non- 
20 volatile memory, 

on subsequent commencement of operation of the processor, checking 
whether the non- volatile memory includes a record of a fault signal and when 
the non-volatile memory does not include a record of such a fault signal on 
subsequent commencement, generating an alarm signal. 

25 

Thus when' an operation of the processor is ceased, this forces a fault situation 
onto the electronic system. Thus the cessation of processor operation (in whole 
or in part) should result in the generation of a fault signal by the fault detecting 
circuit. If a fault signal is generated, a record of this is kept and, when the 



processor is next started up, the memory is examined to see if a record is 
stored. If the fault-detecting device has detected the forced fault situation, then 
the fault-detecting device is deemed to be operating properly. If not, then an 
alarm signal is generated. 

The fault detecting device may comprise a voltage detector which generates a 
fault signal when an over-voltage or an under-voltage occurs. Additionally or 
alternatively, the fault-detecting device may comprise a device for monitoring 
the operation of the processor and generating a fault signal when a fault with 
the operation of the processor is detected (a so-called watchdog device) 

Preferably the non-volatile memory is cleared of the record once it has been 
determined whether or not the non-volatile memory includes a record. 

In a second aspect of the invention there is provided an electronic system 
including a processor, the system being arranged to: 

stop operation of the processor and monitor for the generation of a fault 
signal from a fault-detecting device, 

on generation of a fault signal from the fault-detecting device on 
stopping of the operation of the processor, store a record to this effect in non- 
volatile memory, 

on subsequent commencement of operation of the processor, check 
whether the non-volatile memory includes a record of a fault signal and when 
the non-volatile memory does not include a record of such a fault signal on 
subsequent commencement, generate an alarm signal. 

In a first preferred embodiment of the invention there is provided a self-test 
method in which an electronic system includes a fault-detecting device for 
monitoring the operation of the processor and generating a fault signal when a 



fault with the operation of the processor is detected, the method further 
comprising: 

stopping operation of the processor and monitoring for the generation of 
a fault signal from the fault-detecting device, 

on generation of a fault signal from the fault-detecting device on 
stopping of the operation of the processor, storing a record to this effect in non- 
volatile memory, 

on subsequent commencement of operation of the processor, checking 
whether the non-volatile memory includes a record of a fault signal and when 
the non-volatile memory does not include a record of such a fault signal on 
subsequent commencement, generating an alarm signal. 

In a further preferred embodiment of the invention, there is provided a self-test 
method for an electronic system including a processor, the method comprising: 
stopping operation of the processor and monitoring for an over-voltage 
occurrence, 

when an over- voltage occurrence occurs on stopping of the operation of 
the processor, storing a record to this effect in non- volatile memory, 

on subsequent commencement of operation of the processor, checking 
whether the non-volatile memory includes a record of an over-voltage 
occurrence and, when the non-volatile memory does not include a record of an 
over-voltage occurrence, generating an alarm signal. 

The invention will now be described, by way of example only, with reference 
to the accompanying drawings, in which: 

Figure 1 shows a functional diagram of components of an electronic system 
incorporating a self-test system according to the invention; and 
Figure 2 is a flow diagram illustrating the operation of a self-test system 
according to the invention. 



4 

Figure 1 shows an embodiment of a self test system according to the invention. 
The electronic system incorporates at least one processor 2, a first fault 
detection device in the form of a voltage level detector 4 and a second fault 
5 detection device in the form of a watchdog circuit 6. A second processor 8 
may also be provided to monitor the operation of the first processor 2. 

The voltage level detector 4 includes an op-amp, a first (non-inverting) input of 
which is connected to the supply voltage Vsupp and the second, inverting, input 

10 of which is connected to a reference voltage V ref . In use, the supply voltage of 
the electronic system is likely to change. For instance, when the electronic 
system is powered up, the voltage will increase from nominally OV to a voltage 
in the region of that required by the electronic system e.g. 3V. During this 
ramp-up stage, the voltage may overshoot the required supply voltage. This 

15 results in a so-called over-voltage situation. As this over-voltage may result 
from some fault with the power supply of the electronic system, this is deemed 
to be a fault situation. 

When the magnitude of the supply voltage is greater than the magnitude of the 
20 reference voltage, the op-amp produces an output signal and hence the voltage 
level detector 4 outputs a fault signal. 

The watchdog circuit 6 receives as an input a signal from the processor 2 to 
indicate that the processor is operating correctly. In normal conditions, the 
25 signal is output from the processor 2 in a periodic manner. If the watchdog 
circuit does not receive the signal when it is expecting a signal, the processor is 
determined to be in an abnormal state and the watchdog circuit 6 outputs a fault 
signal in the form of a reset signal. 



In either of these fault detection situations, the processor is reset i.e. the 
operation of the processor is stopped and re-started. 

The level detector 4 and the watchdog circuit 6 are designed to monitor for 
fault conditions. However the electronic system in which these components are 
implemented has no way of knowing whether the fault condition detectors are 
operating properly or not. According to the invention, a self-test is carried out 
each time the microprocessor is shut down, either because of a reset or because 
the associated system has been turned off. 

Thus, according to a first aspect of the invention, when the electronic system is 
to be shut down, the processor monitors for the detection of an over voltage 
condition. If the level detector circuit 4 is operating properly, then the level 
detector circuit 4 should output an over voltage reset signal on shut down. 
Thus, when the system, in particular the processor of the electronic system, is 
shut down, the processor monitors for an over voltage signal at the output from 
the level detector 4. When an over voltage current occurs on stopping of the 
operation of the processor 2, a record to this effect is stored in non-volatile 
memory 10. When the processor 2 next receives a signal to start up, the 
processor looks for the record in the non-volatile memory. If, on start up, such 
a record is not in the non-volatile memory then the processor 2 registers that 
the over voltage detecting circuit 4 has not detected the over voltage situation 
on shut down and that therefore the over voltage detection device 4 is faulty. 
The processor then takes the appropriate action e.g. shutting itself down after 
generating an appropriate fault message. The record in the non-volatile 
memory is preferably cleared when this fault message is generated. 

According to another aspect of the invention, an additional or alternative self 
test may be carried out. This relates to the self testing of the watchdog circuit 



6. This self test is done automatically on shut down of the processor 2. When 
a signal is sent to the processor to cease operation, the processor in response 
ceases sending the periodic signal to the watchdog circuit 6. The watchdog 
circuit 6 then detects that it is not receiving the usual periodic signals from the 
microprocessor 2 and thus generates a reset signal. This is received by the 
processor 2 and a record of this reset signal is stored in the non-volatile 
memory 10. The processor 2 then shuts down. 

On subsequent commencement of operation of the processor 2, the processor 
carries out a check to see if the non-volatile memory 10 includes a record of the 
reset signal generated by the watchdog device 6. When the non-volatile 
memory does not include such a record, a fault message is then generated and 
the processor shut down. 

Preferably a self test is carried out on shut-down for both the level detector 4 
and the watchdog circuit 6. The watchdog self-test may be carried out first, by 
ceasing the periodic signal from the processor 2 to the watchdog circuit 6, and 
monitoring for a fault signal from the watchdog circuit. This may then be 
followed by the level detector self-test. 

In a further aspect of the invention a self-test is also carried out on start up. As 
explained above, the supply voltage V supp ramps up to the required level on 
start up. Therefore a self-test of the level detector 4 is also carried out on start 
up to test that the level detector 4 is correctly detecting an under- voltage 
situation. Thus on starting operation of the processor, the self-test routing 
monitors for the generation of a fault signal from the level detector 4. On 
generation of a fault signal from the fault-detecting device on starting of the 
operation of the processor, a record to this effect is stored in the non- volatile 
memory 10. On subsequent receipt of a message to stop operation of the 




processor, the processor checks whether the non-volatile memory 10 includes a 
record of a fault signal and when the non- volatile memory does not include a 
record of such a fault signal, an alarm signal is generated. 

5 Figure 2 is a flow diagram showing the operation of the self test program. This 
routine is run on start up or shut down (e.g. when the ignition of a vehicle is 
started or on or after a reset or any other reason). In the first step (201) the 
processor receives a command to switch off. This may be due to a reset from 
the watch dog application or the voltage detector (or another fault detection 
. 10 device). The processor then ceases an operation (202), the cessation of which 
is intended to generate a fault condition. The system then runs the self test 
routine as discussed above i.e. monitors (203) to see whether the watch dog 
application outputs a fault flag and/or whether the voltage detector outputs the 
fault flag. If a fault signal is output from the fault-detecting device, then a 
15 record of the fault signal is stored (204) in non- volatile memory. In either case, 
the processor then shuts down all operations (205). 

On subsequent start-up of the processor (206) (either as a result of a reset signal 
or because the system is powered up by a user), the processor checks whether a 

20 record is stored in the non-volatile memory for the elf-test that was carried out 
on shut-down. If no such record is present in the non- volatile memory, then an 
alarm signal is generated (207). This alarm signal or message indicates that the 
associated fault detection component is not operating properly. In response, 
the processor would usually shut down until the fault is cleared. However if 

25 the non-volatile memory does include a record for the associated fault detection 
component, the electronic system can continue to operate as normal (208). 

If an under- voltage self -test is also to be carried out, the processor may, before 
step 208, check for the existence of a record indicating that the level detector 4 
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detected an urider-voltage situation on the previous start-up of the processor. If 
no such record is detected, an alarm signal may be generated (207). 
Alternatively the processor may run another sub-routine after step 208 in which 
the processor shuts itself down and starts itself up again to run the under- 
voltage routine. This additional stop/start routine will result in a small delay in 
starting of the processor for normal operation but is unlikely to be noticeable to 



a user. 



Claims 

1. A self-test method for an electronic system including a processor, the 

method comprising: 

stopping operation of the processor and monitoring for the generation of 

a fault signal from a fault-detecting device, 

on generation of a fault signal from the fault-detecting device on 
stopping of the operation of the processor, storing a record to this effect in non- 
volatile memory, 

on subsequent, commencement of operation of the processor, checking 
whether the non-volatile memory includes a record of a fault signal and when 
the non-volatile memory does not include a record of such a fault signal on 
subsequent commencement, generating an alarm signal. 

2. A self-test method according to claim 1 wherein the fault detecting 
device comprises a voltage detector which generates a fault signal when an 
over- voltage occurs. 

3. A self-test method according to claim 1 or 2 wherein the fault-detecting 
device comprises a device for monitoring the operation of the processor and 
generating a fault signal when a fault with the operation of the processor is 
detected. 

4. A self-test method according to claim 1 further comprising clearing the 
non-volatile memory of the record once it has been determined whether or not 
the non-volatile memory includes a record. 



5. A self-test method for an electronic system including a processor and a 
fault detecting device for monitoring the operation of the processor and 
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generating a fault signal when a fault with the operation of the processor is 
detected, the method comprising: 

stopping operation of the processor and monitoring for the generation of 
a fault signal from the fault-detecting device, 

on generation of a fault signal from the fault-detecting device on 
stopping of the operation of the processor, storing a record to this effect in non- 
volatile memory, 

on subsequent commencement of operation of the processor, checking 
whether the non-volatile memory includes a record of a fault signal and when 
the non-volatile memory does not include a record of such a fault signal on 
subsequent commencement, generating an alarm signal. 

6. An electronic system including a processor, the system being arranged 
to: 

stop operation of the processor and monitor for the generation of a fault 
signal from a fault-detecting device, 

on generation of a fault signal from the fault-detecting device on 
stopping of the operation of the processor, store a record to this effect in non- 
volatile memory, 

on subsequent commencement of operation of the processor, check 
whether the non-volatile memory includes a record of a fault signal and when 
the non-volatile memory does not include a record of such a fault signal on 
subsequent commencement, generate an alarm signal. 

7. An electronic system according to claim 6 wherein the fault detecting 
device comprises a voltage detector which generates a fault signal when an 
over-voltage occurs. 
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8. An electronic system . according to claim 6 or 7 wherein the fault- 
detecting device comprises a device for monitoring the operation of the 
processor and generating a fault signal when a fault with the operation of the 
processor is detected. 

9. An electronic system according to claim 6, 7 or 8 further arranged to 
clear the non-volatile memory of the record once it has been determined 
whether or not the non-volatile memory includes a record of an fault signal. 

10. A self-test method for an electronic system including a processor, the 

method comprising: 

starting operation of the processor and monitoring for the generation of 

a fault signal from a fault-detecting device, 

on generation of a fault signal from the fault-detecting device on starting 
of the operation of the processor, storing a record to this effect in non-volatile 
memory, 

on subsequent stopping of operation of the processor, checking whether 
the non-volatile memory includes a record of a fault signal and when the non- 
volatile memory does not include a record of such a fault signal on subsequent 
stopping, generating an alarm signal. 
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ABSTRACT 
SELF-TEST SYSTEM 

The invention relates to a self-test system for use with an electronic system that 
includes a processor. The self-test method comprises: 

stopping operation of the processor and monitoring for the generation of 
a fault signal from a fault-detecting device, 

on generation of a fault signal from the fault-detecting device on 
stopping of the operation of the processor, storing a record to this effect in non- 
volatile memory, 

on subsequent commencement of operation of the processor, checking 
whether the non-volatile memory includes a record of a fault signal and when 
the non-volatile memory does not include a record of such a fault signal on 
subsequentcommencement, generating an alarm signal. 
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